---
title: '10 AWS Cloudfront'
disqus: hackmd
---

:::info
AWS Certified Developer Associate DVA-C01
:::

10 AWS Cloudfront
===

<style>
img{
/* border: 2px solid red; */
margin-left: auto;
margin-right: auto;
width: 90%;
display: block;
}
</style>

## Table of Contents

[TOC]

AWS Cloudfront
---
- is content delivery network (CDN)
- improves read perf as content distributed and cached at edge locations around world
- improve latency
- 216 pt of presence globally
- edge locations
- always growing
- DDos protection, integration with shield, AWS web app firewall
- very protected
- good way to front apps when u deploy them globally
- can expose external https by loading certs & can talk to internal https backends
- https://aws.amazon.com/cloudfront/features/?nc=sn&loc=2
- everything here is edge
- client access edge through pub network, edge access bucket through aws priv network


### Cloudfront at High Level
- edge location caches response based on cache settings defined and return resp to client
- when client makes similar req, edge location will 1st look in cache before forwarding req to origin (whole purpose of using CDN)

### Cloudfront Origins
- s3 buckets
- for distributing files globally and caching them at edge
- enhanced security with cloudfront __Origin access identity (OAI)__
- allow s3 bucket to only allow communication from cloudfront and nowhr else
- cloudfront can be used as an ingress to upload files to s3 from anywhr in world
- custom origin (must be HTTP endpt)
- app load balancer
- ec2 instance
- s3 website
- must 1st enable bucket as static s3 website
- any http backend you want

#### S3 as an Origin
- for edge location to access your s3 origin bucket, must use OAI which is an iam role for your cloudfront origin

#### ALB or EC2 as an Origin
- sec grp of ec2 must allow ip of cloudfront edge locations into it
- can get list of pub ip of edge locations here
- http://d7uri8nf7uskq.cloudfront.net/tools/list-cloudfront-ips
- same for alb
- sec grp of ec2 can be priv though

### Cloudfront Geo Restriction
- is a security measure
- can restrict who can access your distribution
- whitelist
- allow users to access content only if they're in 1 of approved countries
- blacklist
- prevent user from accessing content based on list of banned countries
- the country is determined using a 3rd party geo-ip database
- use case
- copyright laws to control access to content

### Cloudfront VS S3 Cross Region Replication
- cloudfront
- global edge network
- files attached for ttl
- maybe a day
- great for static content that must be avail everywhr
- s3 cross region replication
- must be setup for ea region u want replication to happen
- files updated in near real-time
- read only
- help with read perf
- great for dynamic content that needs to be avail at low-latency in few regions

### Cloudfront Caching
- cache based on
- headers
- session cookies
- query string params
- cache lives at ea cloudfront edge location
- u want to maximise cache hit rate to minimise requests to origin
- control the ttl (0 secs to 1 year)
- can be set by origin using the `Cache-Control` header, `Expires` header
- can invalidate part of the cache using `CreateInvalidation` API


#### Maximise Cache Hits by Separating Static and Dynamic Distributions
- for static traffic, no headers and no session caching rules must apply
- all content is cached in cloudfront to maximise cache hits
- for dynamic content need to be more careful abt how we want to cache based on the values of headers and cookies

### Cloudfront and HTTPS
- __viewer protocol policy__
- redirect http to https
- or use https only
- __origin protocol policy (http or s3)__
- https only
- or match viewer
- HTTP => HTTP & HTTPS -> HTTPS
- NOTE
- s3 bucket websites dont support https
- only can use http


### Cloudfront Signed URL/Signed Cookies
- want to distribute paid shared content to premium users over world
- to restrict viewer access, can create cloudfront signed url/cookie
- validity length of url
- shared content (movie, music)
- short - few mins
- priv content (priv to user)
- can make it last for years
- signed url = access to indiv files
- 1 signed url per file
- signed cookies = access to multiple files
- 1 signed cookie for many files

- objs in bucket can only be accessed by cloudfront
- client authorise and auth through app
- app use aws sdk to generate signed url to clients
- clients use signed url to get data directly from cloudfront

### Cloudfront Signed URL VS S3 Pre-Signed URL

- cloudfront signed url
- allow access to path no matter the origin
- not just s3 but http etc.
- acc wide key-pair
- only root can manage it
- can filter by ip, path, date and expiration
- can leverage caching features


- s3 presigned url
- issue request as person who presigned url
- uses iam key of signing iam principal
- limited lifetime
- NOTE
- if have cloudfront distro infront of bucket, can only use cloudfront signed url as thr's bucket policy restricting access to OAI
- use presigned url if dw use cloudfront

### Console
- create web distribution
- will take awhile to create

- restrict bucket access option
- if select yes, will have more options appear
- restrict so users must use cloudfront url not s3 url to access s3 contents
- need to create or use an existing origin access identity OAI


- auto add bucket policy saying that OAI can getobject from s3 bucket
- only cloudfront user can access bucket

- if get redirected to s3 url instead of cloudfront, is dns issue and must wait 3/4 hours
- dns to propagate properly
- https://stackoverflow.com/questions/38735306/aws-cloudfront-redirecting-to-s3-bucket
- not a bug


- also need make s3 bucket files public

#### Cloudfront Caching
- edit ttl in behaviour settings of cloudfront distribution

- by invalidating an obj, u remove them from the cloudfront edge caches

- `*` mean everything
- cloudfront talk to all edge in the world and tell them to flush their cache based on this setting

#### Cloudfront Security
- OAI security
- only specific OAI can access s3 bucket based on bucket policy

- viewer protocol policy in distribution behaviour
- dont see anything for origin protocol policy cuz we linked to s3 bucket
- will have option if we have a http origin

- set geo restriction for distro
- access from restrictions tab in distro

Quiz
---
- i dont get why cloudfront is not the ans
- get from pub edge location > retrieve frem s3 using priv subnet = faster

###### tags: `AWS Developer Associate` `Notes`